CVE-2026-48595

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request. This issue affects tesla: from 1.4.0 before 1.18.3.

### Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string `"authorization"`. Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing (`"Authorization"`) bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at. ### Details The filter list in `lib/tesla/middleware/follow_redirects.ex` is defined as `@filter_headers ["authorization", "host"]` and the membership check `k not in @filter_headers` compares the raw key string without case normalization. HTTP header names are case-insensitive per RFC 7230, but Tesla stores them verbatim. A header tuple `{"Authorization", "Bearer …"}` does not match `"authorization"`, so it passes through the filter and is forwarded to the redirect destination unchecked. The same defect applies to the `"Host"` entry. An attacker who can control a `Location:` response seen by the victim client (their own endpoint, a redirect-open service, or a compromised upstream) receives the credential on the cross-origin follow. No special configuration is required beyond the victim using the standard header casing. ### PoC 1. Configure a Tesla client with `Tesla.Middleware.FollowRedirects` and set the `Authorization` header using canonical casing (`{"Authorization", "Bearer <token>"}`). 2. Make a request to an endpoint that returns a `302` redirect to a different origin. 3. Observe that the `Authorization` header with its value is present in the request delivered to the redirect destination. ### Impact High severity (CVSS v4.0: 8.2). Any application using `tesla` 1.4.0 through 1.18.2 with `Tesla.Middleware.FollowRedirects` and a non-lowercase `Authorization` header is affected. The workaround is to use all-lowercase `"authorization"` as the header key until upgrading to 1.18.3. ### Workarounds Normalize all header keys to lowercase before passing them to Tesla. Use `"authorization"` instead of `"Authorization"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`. ### Resources * Introduction commit: https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f * Patch commit: https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182

### Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string `"authorization"`. Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing (`"Authorization"`) bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at. ### Details The filter list in `lib/tesla/middleware/follow_redirects.ex` is defined as `@filter_headers ["authorization", "host"]` and the membership check `k not in @filter_headers` compares the raw key string without case normalization. HTTP header names are case-insensitive per RFC 7230, but Tesla stores them verbatim. A header tuple `{"Authorization", "Bearer …"}` does not match `"authorization"`, so it passes through the filter and is forwarded to the redirect destination unchecked. The same defect applies to the `"Host"` entry. An attacker who can control a `Location:` response seen by the victim client (their own endpoint, a redirect-open service, or a compromised upstream) receives the credential on the cross-origin follow. No special configuration is required beyond the victim using the standard header casing. ### PoC 1. Configure a Tesla client with `Tesla.Middleware.FollowRedirects` and set the `Authorization` header using canonical casing (`{"Authorization", "Bearer <token>"}`). 2. Make a request to an endpoint that returns a `302` redirect to a different origin. 3. Observe that the `Authorization` header with its value is present in the request delivered to the redirect destination. ### Impact High severity (CVSS v4.0: 8.2). Any application using `tesla` 1.4.0 through 1.18.2 with `Tesla.Middleware.FollowRedirects` and a non-lowercase `Authorization` header is affected. The workaround is to use all-lowercase `"authorization"` as the header key until upgrading to 1.18.3. ### Workarounds Normalize all header keys to lowercase before passing them to Tesla. Use `"authorization"` instead of `"Authorization"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`. ### Resources * Introduction commit: https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f * Patch commit: https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182

Vulnerabilidad de manejo inadecuado de la distinción entre mayúsculas y minúsculas en elixir-tesla tesla permite la fuga de credenciales a un origen de terceros en redirecciones de origen cruzado. Tesla.Middleware.FollowRedirects elimina encabezados sensibles a la seguridad en redirecciones de origen cruzado utilizando una comparación de cadenas que distingue entre mayúsculas y minúsculas contra una lista de filtros en minúsculas (@filter_headers ['authorization', 'host']). Los nombres de los encabezados HTTP no distinguen entre mayúsculas y minúsculas según la RFC 7230, pero Tesla conserva las claves de los encabezados textualmente tal como las proporciona el llamador sin normalizar las mayúsculas y minúsculas. Un encabezado establecido como {'Authorization', 'Bearer ...'} (la capitalización canónica de la RFC 7235 utilizada por prácticamente todas las bibliotecas y documentación HTTP) no coincide con la entrada del filtro en minúsculas y se reenvía al destino de la redirección. Un atacante que puede controlar o influir en una respuesta Location: vista por el cliente (a través de su propio punto final, un upstream de redirección abierta o un origen comprometido) recibe el token de portador u otro material de autorización en la solicitud de origen cruzado. Este problema afecta a tesla: desde 1.4.0 antes de 1.18.3.